Hi, just my feedback about the mdsec lab.As i've bought the book 3 month ago i've decided for this new year to buy 5 hours of training lab.

Right now i've spent only two hours in the lab and i have done the 3 first modules, Mapping the Application, Using Automation and Bypassing Client Side Controls.

You have to read the book first because there is no explanation in the lab, only exercises, exercises and exercises...One negative point is that there is no answer so if you don't find how to do it then you can't have any advices from the lab but on the other hand it makes you working harder to find the solution.

The 3 modules i've done aren't so difficult and you can find a lot of advices in the WAHH, i don't know if it's gonna be the same thing for the other one.

Thanks n3r. From what you say, it seems like the labs might not be as expensive as I thought. I'm planning to try the labs once I finish the book (but I just started), so let me know your overall thoughts once you finish them all.

Also, it helps if you have specific questions. i.e. "In this scenario, how could I leverage this vulnerability to do x, y, and z."

On a relate note, I purchased this book the other day, and I intend to go through all the labs. I'll definitely post a review once I'm done, but it may be six weeks or so with everything else I have going on

Yes. I have problem with all three cases in "incomplete validation of credentials".I try removing last character, changing the case of a charater and add special characters - such as .$)(/.But I can't find any problem with validation of password.

ggeorge wrote:Yes. I have problem with all three cases in "incomplete validation of credentials".I try removing last character, changing the case of a charater and add special characters - such as .$)(/.But I can't find any problem with validation of password.

Did you try the examples from the book? The website says they will work there, so I guess they should.

tturner wrote:For those who have done the labs and read all of WAHHv2, how much lab time would you recommend? I'm getting ready to buy some but won't be able to buy more if I run out.

If you're asking me, no idea sorry But generally speaking, depending on how many challenges are available, 30-60 minutes per challenge if they're not like super easy, is probably what I'd recommend. If you're good, you can probably do most of the challenges in 15-30 min., or less, but as I haven't done their labs yet, not sure.

I guess that I could attempt to do them for fun, and see how far I can get, just to try it out

The amount of time it takes to go through an exercise will obviously vary a great deal based on experience

With some exercises, there's no obvious way to know that it's been completed. It's possible for you to feel pretty good about where you're at but then discover another interesting item 15 minutes later

You need to use your allotted time in one-hour increments. You may not feel like moving on to the next item with only 5-10 minutes remaining, so you might want to factor in a few extra hours for padding

Based on what I saw while browsing through the exercises, I think most people are going to average over one-hour for each section. 15-20 hours would probably be a fairly aggressive pace for most people, and many will probably be the most comfortable in the 20-30 hour range, if not higher.

Alternatively, more advanced users may want to get a smaller block of hours (i.e. 10) and skip the exercises they don't feel would be worth their time. You can pick-and-choose what to do; you don't need to go in order.

I'm personally expecting to put 25-30 hours into this because I have OCD and want to be thorough. I'm competent with most web technologies, but I haven't spent a great deal of time focusing on offensive tools and techniques.

I assume you only have one shot at purchasing hours because your company is paying for it and you need to get a PO issued. For people that aren't required to purchase everything thing at once, there's no penalty for purchasing hours in small increments. Most people would probably be more comfortable with purchasing 3-5 hours at a time.

If I had to purchase everything at once, I'd go for a little more than I was expecting to use. At $7/hr, you're not going to waste a significant amount of money unless your estimate ridiculously off.